2.14. Configuring an NFS client with mutual TLS support

Procedure

1. Create a private key and a certificate signing request (CSR):

   # openssl req -new -newkey rsa:4096 -noenc \
   -keyout /etc/pki/tls/private/client.example.com.key \
   -out /etc/pki/tls/private/client.example.com.csr \
   -subj "/C=US/ST=State/L=City/O=Organization/CN=client.example.com" \
   -addext "subjectAltName=DNS:client.example.com,IP:192.0.2.2"

   重要

   Common Name (CN) and DNS must match the hostname. IP must match IP of the host.

2. Send the /etc/pki/tls/private/client.example.com.csr file to a Certificate Authority (CA) and request a client certificate. Store the received CA certificate and the client certificate on the host.

3. Import the CA certificate to the systems’s truststore:

   # cp ca.crt /etc/pki/ca-trust/source/anchors
   # update-ca-trust

4. Move the client certificate to the /etc/pki/tls/certs/ directory:

   # mv client.example.com.crt /etc/pki/tls/certs/

5. Ensure the SELinux context is correct on the private key and certificates:

   # restorecon -Rv /etc/pki/tls/certs/

6. Add the client certificate and private key to the [authenticate.client] section in the /etc/tlshd.conf file:

   x509.certificate= /etc/pki/tls/certs/client.example.com.crt
   x509.private_key= /etc/pki/tls/private/client.example.com.key

   Leave the x509.truststore parameter unset.

7. Enable and start the tlshd service:

   # systemctl enable --now tlshd.service

8. Mount an NFS share by using TLS encryption:

   # mount -o xprtsec=mtls server.example.com:/nfs/projects/ /mnt/